Clear cached pages and data when someone signs out

How to do it

A service worker that cached a signed-in page shows it to the next person on a shared device, even after sign-out. Send Clear-Site-Data: "cache", "cookies", "storage" on the sign-out answer. Browsers that support it then drop caches, storage and service worker registrations for the site. Also delete the caches from the page with caches.delete before the redirect, for browsers that ignore the header. End the session on the server too, as Let people sign out of one device or all of them says. Better still, never cache private answers in the worker, as Keep working when the network drops says.

Examples

JavaScript example

app.post('/sign-out', (req, res) => {
  req.session.destroy(() => {
    res.set('Clear-Site-Data', '"cache", "cookies", "storage"').redirect(303, '/');
  });
});

Python example

@app.post("/sign-out")
def sign_out(request: Request):
    request.session.clear()
    response = RedirectResponse("/", status_code=303)
    response.headers["Clear-Site-Data"] = '"cache", "cookies", "storage"'
    return response

How to check

A browser test signs in, opens the account page, and signs out. Afterwards caches.keys() returns an empty list, local storage is empty, and the account page is not served while offline.

Sources

• W3C Clear Site Data
• OWASP Session Management Cheat Sheet

Related rules

• ACC-32 Put sign-out on every signed-in page in Accounts and identity
• APP-76 Keep tokens and sensitive data out of browser storage in Web app interface
• APP-59 Sign out every open tab together in Web app interface
• ACC-28 Let people sign out of one device or all of them in Accounts and identity
• WEB-224 Keep working when the network drops in Website